- add mark-stable workflow that runs on workflow_run for all test pipelines - use GitHub API to ensure all required workflows succeeded before moving the 'stable' tag - add Nix flake.lock to pin nixpkgs for reproducible builds https://chatgpt.com/share/693aa4a6-7460-800f-ba47-cfc15b1b2236